EasyDNS has admitted responsibility for the hijacking of eth.limo, citing the company's first social engineering attack in its 28-year history.

April 20 — The Ethereum Name Service (ENS) gateway eth.limo was briefly hijacked at its domain registrar Friday night, according to The Block. In a post-incident analysis report released Saturday, the project team attributed the breach to a social engineering attack. Per the post-incident report and a separate blog post by Mark Jeftovic, the attacker impersonated an eth.limo team member on April 17 at 7:07 p.m. Eastern Time to trick domain registrar EasyDNS into initiating an account recovery process. Timeline details: - 2:23 a.m. April 18: The attacker switched eth.limo’s domain servers to Cloudflare, triggering an automatic downtime alert that notified the eth.limo team. - 3:57 a.m.: Domain servers were switched back to Namecheap. - 7:49 a.m.: EasyDNS restored the team’s account access. Eth.limo is a free, open-source reverse proxy service that lets users access ENS-linked content (hosted on IPFS, Arweave, or Swarm) by appending “.limo” to any .eth domain — enabling access via standard browsers. Per data cited by EasyDNS, its *.eth.limo wildcard DNS record covers roughly 2 million .eth domains registered through ENS.